CVE-2025-13943

Published Feb 24, 2026

Last updated 14 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-13943 is identified as a post-authentication command injection vulnerability affecting specific firmware versions of the Zyxel EX3301-T0 device. This flaw resides within the log file download function of the device's firmware. The vulnerability, categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), allows an authenticated attacker to execute arbitrary operating system commands on the affected device. This is possible due to insufficient neutralization of special characters in user-supplied input within the vulnerable function. The affected firmware versions include those through 5.50(ABVY.7)C0.

Description: A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected device.
Source: security@zyxel.com.tw
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@zyxel.com.tw: CWE-78

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 5

References